diff --git a/.github/workflows/ci-web.yml b/.github/workflows/ci-web.yml
index 85c301c6ba..16f9d1f07c 100644
--- a/.github/workflows/ci-web.yml
+++ b/.github/workflows/ci-web.yml
@@ -231,10 +231,13 @@ jobs:
             echo "No playwright-report/ produced; skipping S3 upload"
             exit 0
           fi
+          # Reports are stamped with run_id + attempt in S3_KEY_PREFIX, so a given
+          # key is immutable once written — safe to cache aggressively. 30 days
+          # matches the retention-days on the GHA artifact upload above.
           aws s3 cp \
             --recursive \
             --acl=public-read \
-            --cache-control "public, max-age=600" \
+            --cache-control "public, max-age=2592000, immutable" \
             web/playwright-report/ \
             "s3://${S3_BUCKET}/${S3_KEY_PREFIX}/"
       # Same-repo guard: fork PRs run with a read-only GITHUB_TOKEN (even after